Device Class 1: Process Isolation

Control ID: SC-39 Process Isolation Family: System and Communications Protection Source: NIST 800-53r4
Control: The information system maintains a separate execution domain for each executing process.
Supplemental Guidance:
Information systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each information system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial operating systems that employ multi-state processor technologies.

Related Controls: AC-3, AC-4, AC-6, SA-4, SA-5, SA-8, SC-2, SC-3
Control Enhancements: N/A
References: N/A
Mechanisms:

  • Devices shall provide a separate address space for each executing process .
  • Devices shall ensure that access to protected resources, including signing keys, is only granted to processes that have the appropriate permissions per AC-3 .
  • Devices shall provide Address Space Layout Randomization, Data Execution Prevention, and application sandboxing.

Protocol Implementation Conformance Statements:
ID Statement Status Reference Notes
SC-39/1 Supports separate execution domain for each process M
SC-39/2 Provides separate address space for each executing process M
SC-39/3 Resources protected by appropriate permissions M AC-3
SC-39/4 Provides Address Space Layout Randomization M
SC-39/5 Provides Data Execution Prevention M
SC-39/6 Provides Application Sandboxing M